Help with really bad virus problem please?

[oldman]

Hi jaxter9000,

It takes awhile. Please be patient as it is worthwhile.

[jaxter9000]

Ok, the update is finished and the scan is underway. I am very sorry, oldman, but I am going to have to get back to you in the morning with these scan results. I would probably fall asleep in my chair here if I waited for it to finish scanning right now.

I will leave my computer on overnight to scan and post the results tomorrow.

[DavidR]

I finished the scan on safe mode, but the resolution problem wouldn't let me get to the "Save" button. I feel like a failure at life.

Tip for the future when in 800x600 resolution 'safe' mode, you can move the window up manually. If you right click on the windows tab in the task bar at the bottom of thw windows screen, select Move, now using the keyboard navigation arrows keep clicking the Up arrow that should move the window up so you can access the Save button. The other arrows move it in the direction indicated.

[jaxter9000]

Thank you DavidR, that's very useful!! 

Here's the log.

[oldman]

Hi jaxter9000,

The detection is a file we have quarantined and will be removed when we remove the tools.

If no problems we'll clean up now. I believe DavidR had some advice regarding accounts. I'll leave that to him.

From your desktop, please delete

• any notepads/logs that we created
• GMER.zip
• GMER.exe

Next

Open OTL then click the Clean Up button. You may get prompted by your firewall that OTL wants to contact the internet -  allow this.  A cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will do some clean up tasks and delete some of the tools you have downloaded plus itself.

I suggest you keep MBAM. Keep it updated and use it regularly.



* Create a new restore point

You must be logged on to an administrator account

• Go to Start - All Programs - Accessories - System Tools - System Restore.
• Click Create a restore point, and then click Next.
• In the text box labeled Restore Point Description, type a name for this restore point
• click create

* Remove old restore points

• Go to Start - All Programs - Accessories - system tools.
• Launch the Disk Cleanup tool and let it run.
• When it finishes a box with tabs will appear, select the more options tab.
• On this tab you will find a section for System Restore.
• If you press the Clean Up button for that section, Windows will delete all restore points except for the most recent one.

Some Recommendations and prevention tips

Basic security consists of 1 antivirus program, 1 resident antispyware program, 1 on demand antispyware program and a firewall. Just add a firewall and an resident antispyware.

I suggest either of these  or ask in the General Forum

Windows Defender
 OR
Winpatrol

* If you are behind a router Windows firewall should be fine. Otherwise a 3rd party firewall with outbound monitoring is recommended.

Click FIREWALL for tips, reviews and links to good, free and paid for firewalls. (Note: Zone Alarm is becoming bloatware)

You should also use Spyware Blaster to help immunize your computer.

 - SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.
 
OR

A guide to understanding and using the hosts file.

Learn how your Hosts file can protect you and how you can protect it.
Besides the Hosts file information, there are links to a very good updated hosts file, a host file manager. and some programs that can protect your hosts file.
HOSTS

Please read the info on disabling the DNS Client before installing a custom hosts file.

-Secure your Internet Explorer

From within Internet Explorer click on the Tools menu and then click on Options.

• Click once on the Security tab
• Click once on the Internet icon so it becomes highlighted.
• Click once on the Custom Level button.
• Change the Download signed ActiveX controls to Prompt
  
• Change the Download unsigned ActiveX controls to Disable
  
• Change the Initialize and script ActiveX controls not marked as safe to Disable
  
• Change the Installation of desktop items to Prompt
  
• Change the Launching programs and files in an IFRAME to Prompt
  
• Change the Navigate sub-frames across different domains to Prompt
  
• When all these settings have been made, click on the OK button.
  
• If it prompts you as to whether or not you want to save the settings, press the Yes button.
  

Next press the Apply button and then the OK to exit the Internet Properties page.

- Keeping your Windows up-to-date is crucial to your computer's security. Please go to the Windows Update Site (using Internet Explorer) and download and install all critical updates on a regular basis

- Ensure that Automatic Update is turned on so you get all the latest patches.
Click start, control panel, click Security Center.

- Keep your antivirus program updated, as well as any other security programs you have.

-More tips and programs can be found HERE

- You may also want to read this article By Tony Klein
http://www.freedomlist.com/forum/viewtopic.php?t=22879

Take care

[jaxter9000]

When I downloaded Windows Defender on Firefox, the open button was grayed out still even though the viruses are gone. What do I do?

[oldman]

Hi jaxter9000,

Try clicking the Open button. Did it change?

[jaxter9000]

Here are some screenshots of what is happening.

When I click the open button, nothing happens.

[oldman]

Hi jaxter9000,

Interesting, try downloading it with internet explorer. Save the file to your desktop and try to open it.

[jaxter9000]

The file loaded from Internet Explorer. Firefox seems to be messed up. I really don't like using Internet Explorer though, I have heard that it is very unsafe.

[jaxter9000]

I found the problem!! I had the setting for the "Standard Shield" on Avast set to "Deny the operation" under "Blocker" settings. Once I changed it back to "Allow the operation", every thing is fine!!!

I posted a picture to show what I mean.

[DavidR]

User Accounts and the damage that can be done if you run with the highest permission.

Malware inherits

Administrator account, you shouldn't use this account routinely as it effectively gives permission for malware to do anything that the Administrator account can do, virtually anything it wants.

User account with administrator privileges, whilst malware can still inherit a powerful set of permissions, it isn't quite as potentially damaging as if running under the Administrator account.

Limited User accounts, this is by far the safest account, it isn't totally safe, but malware is somewhat restricted in what it can do and effectively can only work in the User area. This limits the damage malware can do and should also make it easier to deal with.

Now many people feel that they can't run their system from a limited user account as some of the things that they do require admin privileges. It is possible to use the right click and Run As function and switch to a user account with admin privileges or the administrator account.

If that isn't possible or undesirable then it is possible to use an account with admin privileges (but not the administrator account) to use a tool called DropMyRights for specific programs. The programs that I use DropMyRights with are the ones that have internet access, browsers, email clients, etc. So they are effectively running on a limited user permission set, whilst you stil use an account with admin privileges.

-- SECURITY TIPS, TRICKS & INFO
You might also consider proactive protection, in order to place files in the system folders and create registry entries you need permission. Prevention is much better and theoretically easier than cure.
Whilst browsing or collecting email, etc. if you get infected then the malware by default inherits the same permissions that you have for your user account. So if the user account has administrator rights, the malware has administrator rights and can reap havoc. With limited rights the malware can't put files in the system folders, create registry entries (outside of the HKEY_CURRENT_USER registry area), etc. This greatly reduces the potential harm that can be done by an undetected or first day virus, etc.
Browsing the Web and Reading E-mail Safely with an Administrator group User account. This obviously applies to those NT based OSes that have administrator settings, winNT, win2k, winXP. Check Bob's, setup instructions and importantly the dropmyrights.msi file needed as MS have now cleared the original link.
http://mysharedfiles.no-ip.org/dropmyrights

[oldman]

Hi jaxter9000,

I found the problem!!

Good job.

The reason I asked you to use IE was to see if the problem was just FireFox. As far as IE being unsafe, well it does have some vulnerbilities. The key is updates, security programs and surfing habit. I've used IE for a long time and haven't had any problems. There is malware which will effect FireFox but not IE so again, watch what you click on.

Follow DavidR's advice and consider using an account with limited privledges.

[jaxter9000]

On a day-to-day basis I do the following:

-Play video games (sometimes online, and some not online).

-Use a voice chat program called Ventrilo.

-Listen to music, go on social networking site, and do studying for school on the internet.

Would I be able to do these things on a limited user account?

[DavidR]

I would say for most of them probably yes - Try setting up a limited account and see ?

That way you would find anything in your day to day use that requires admin privileges and then I would ask the program maker why it is required.

For many programs you need to have an account with admin privileges to install it, but not to use it, even some security applications will run on a limited user account. avast will run on a limited user account (but need to be installed and registered on an account with admin privileges), it can even update the VPS signatures. It can't do a program update from a limited user account, so you would have to switch user to do that, fortunately program updates aren't too frequent. You also can't schedule an avast boot-time scan from a limited user account.

So if you find applications that make it awkward or unreasonable to run in a limited user account you use an account with admin privileges (not the administrator account) and utilise the DropMyRights tool that I suggested for internet facing applications.